Information Security Threats and Vulnerabilities CCT Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company has a public-facing web application and an internal employee portal. The security team is conducting a risk assessment and wants to reduce the attack surface. Which of the following actions would most effectively reduce the attack surface?

   • ARemove all unused features and modules from the web application
   • BImplement a bug bounty program to find vulnerabilities
   • CIncrease the number of security personnel monitoring the applications
   • DAdd more firewalls to the network perimeter
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A vulnerability assessment reveals that a web application has a SQL injection vulnerability that could allow an attacker to read the entire customer database. The application is internet-facing and is the company's primary revenue source. What is the most appropriate risk treatment?

   • AMitigate the risk by applying a web application firewall (WAF) rule and scheduling a code fix
   • BAccept the risk because the vulnerability has not been exploited yet
   • CTransfer the risk by purchasing cyber insurance
   • DAvoid the risk by taking the application offline indefinitely
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which type of threat actor is typically motivated by financial gain and uses sophisticated techniques to steal data or money?

   • AHacktivist
   • BInsider
   • CCybercriminal
   • DNation-state
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst is conducting a vulnerability assessment of a new web application. The scan identifies several missing security headers and a potential SQL injection point. The analyst must prioritize which findings to report to management. Which approach best aligns with the purpose of a vulnerability assessment?

   • AReport the missing security headers as higher priority because they are easier to fix
   • BReport only the SQL injection and ignore the missing headers because they are not exploitable
   • CReport the SQL injection as higher priority because it has a greater potential impact on data confidentiality
   • DReport all findings equally, since any vulnerability could be exploited
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following best describes a phishing attack?

   • ASending fraudulent emails that appear to come from a trusted source to trick recipients into revealing sensitive information
   • BIntercepting and altering communications between two parties without their knowledge
   • COverwhelming a server with traffic to make it unavailable to users
   • DExploiting a software vulnerability to gain unauthorized access to a system
   Reveal Solution Discussion Select an answer first